Vercel / Next.js / Lemon Squeezy

Debug webhook failures before the buy link goes public.

Turn Vercel 404, 405, 500, missing `order_created`, and invalid `x-signature` symptoms into a PR-ready report. Everything runs locally in this page; no logs, payloads, secrets, or customer data are uploaded.

Open debugger Audit raw body Preview Pro report

Failure shape

Primary symptom Route path Runtime Expected event

Latest status or log line Release note or PR

Route shapeExports POST and deploys at the exact Lemon Squeezy webhook URL.

404 and 405 usually mean the URL, folder, method export, or deployment target does not match.

Raw bodyUses `await request.text()` before any JSON parsing.

Invalid `x-signature` is often caused by parsing or reserializing JSON before verification.

Env secretWebhook signing secret is set in Vercel production env vars only.

The route should fail closed when the env var is missing, without printing the secret.

EventsLemon Squeezy is subscribed to the expected paid event.

`order_created` or subscription events must be enabled on the endpoint that points to production.

Replay safetyDuplicate delivery is guarded by event or object idempotency.

Vercel retries and provider retries should not run fulfillment twice.

Launch evidencePR includes cURL replay, Vercel log, paid event, and rollback notes.

This is the evidence a buyer expects before trusting a paid digital product flow.

Generated report

Score 0

Verdict BLOCKED

Risk High

Signature mismatch debugger Compare raw-body mutation, header format, wrong secret, CRLF, and parser risk. Production checkout readiness Turn live key, CN¥69 price, PayPal, signed webhooks, delivery, and refund checks into a launch report. CN¥69 Pro Kit preview Use the paid pack when you need fixtures, tests, CI examples, and PR evidence in one private ZIP.